Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '%LOCALAPPDATA%\<File name>.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '%LOCALAPPDATA%\<File name>.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Creates the following files on removable media
- <Drive name for removable media>:\dashborder_120.bmp.id[232a6f27-2315].[decrypt@files.mn].banks
- <Drive name for removable media>:\default.bmp.id[232a6f27-2315].[decrypt@files.mn].banks
- <Drive name for removable media>:\sdksampleprivdeveloper.cer.id[232a6f27-2315].[decrypt@files.mn].banks
- <Drive name for removable media>:\contoso_1.cer.id[232a6f27-2315].[decrypt@files.mn].banks
- <Drive name for removable media>:\testee.cer.id[232a6f27-2315].[decrypt@files.mn].banks
- <Drive name for removable media>:\contoso.cer.id[232a6f27-2315].[decrypt@files.mn].banks
- <Drive name for removable media>:\testcertificate.cer.id[232a6f27-2315].[decrypt@files.mn].banks
- <Drive name for removable media>:\dashborder_96.bmp.id[232a6f27-2315].[decrypt@files.mn].banks
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
Executes the following
- '<SYSTEM32>\netsh.exe' firewall set opmode mode=disable
Modifies file system
Creates the following files
- %LOCALAPPDATA%\<File name>.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.id[232a6f27-2315].[decrypt@files.mn].banks
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.id[232a6f27-2315].[decrypt@files.mn].banks
- C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg.id[232a6f27-2315].[decrypt@files.mn].banks
- C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg.id[232a6f27-2315].[decrypt@files.mn].banks
- C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg.id[232a6f27-2315].[decrypt@files.mn].banks
- C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg.id[232a6f27-2315].[decrypt@files.mn].banks
- C:\far2\addons\colors\custom_highlighting\black_from_july.reg.id[232a6f27-2315].[decrypt@files.mn].banks
- C:\far2\addons\colors\custom_highlighting\descript.ion.id[232a6f27-2315].[decrypt@files.mn].banks
- %LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db.id[232a6f27-2315].[decrypt@files.mn].banks
- %LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db-journal.id[232a6f27-2315].[decrypt@files.mn].banks
- %LOCALAPPDATA%\microsoft\windows\caches\cversions.1.db.id[232a6f27-2315].[decrypt@files.mn].banks
- C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg.id[232a6f27-2315].[decrypt@files.mn].banks
Moves the following files
- from %ProgramFiles%\microsoft office\office14\accwiz\acwzlib.accde to %ProgramFiles%\microsoft office\office14\accwiz\acwzlib.accde.id[232a6f27-2315].[decrypt@files.mn].banks
- from %ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde to %ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde.id[232a6f27-2315].[decrypt@files.mn].banks
- from %ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde to %ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde.id[232a6f27-2315].[decrypt@files.mn].banks
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_256.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_96.db
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\netsh.exe' advfirewall set currentprofile state off
